PT-2020-2654 · Cloudbees+1 · Jenkins
Phu X. Mai
·
Published
2020-03-25
·
Updated
2024-03-06
·
CVE-2020-2162
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins versions 2.227 and earlier
Jenkins LTS versions 2.204.5 and earlier
Description
The issue is related to the absence of HTTP Content-Security-Policy headers for files uploaded as file parameters to a build. This results in a stored cross-site scripting (XSS) vulnerability, which can be exploited by users with permissions to build a job with file parameters, allowing remote attackers to perform cross-site scripting attacks.
Recommendations
For Jenkins versions 2.227 and earlier, update to a version that sets Content-Security-Policy HTTP headers when serving files uploaded via a file parameter.
For Jenkins LTS versions 2.204.5 and earlier, update to a version that sets Content-Security-Policy HTTP headers when serving files uploaded via a file parameter.
As a temporary workaround, consider setting the system property
hudson.model.DirectoryBrowserSupport.CSP to override the value of Content-Security-Policy headers sent when serving these files.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins